PasswordsSniffer

PasswordsSniffer Description This module sniff username and password of unprotected protocols. Requirements This package require: python3 python3 Standard Library Scapy Installation root@kitploit: pip install PasswordsSniffer Usages Command line root@kitploit: PasswordsSniffer python3 -m...

CVE-2024-50379-POC

CVE-2024-50379-POC यह रिपॉज़िटरी CVE-2024-50379 का शोषण करने के लिए डिज़ाइन की गई एक Python स्क्रिप्ट शामिल करती है, जो एक ऐसी कमज़ोरी है जो हमलावरों को एक असुरक्षित सर्वर पर JSP शेल अपलोड करने और दूरस्थ रूप से मनमाने कमांड निष्पादित करने की अनुमति देती है। यह एक्सप्लॉइट विशेष रूप से तब उपयोगी हो...

CVE-2026-53760

Admidio versions 5.0.11 and prior are affected by a CSRF vulnerability in the modules/plugins.php endpoint. Plugin install, uninstall, and update operations are handled via GET requests without CSRF token validation. Because browsers send SameSite=Lax cookies on top-level navigations, an attacker...

Prommetrix

معلومات: Prommetrix هي أداة برمجية حرة لاستخراج معلومات ذات صلة من مثيلات 'Node Exporter' التي يشغّلها 'Prometheus'. Prometheus هو حل مفتوح المصدر لمراقبة الأحداث والتنبيهات قائم على المقاييس لتطبيقات السحابة. تستخدمه ما يقرب من 800 منظمة سحابية أصلية بما في ذلك Uber و Slack و Robinhood وغيرها. م...

CVE-2024-10673

🔥 अवलोकन यह स्क्रिप्ट CVE-2024-10673 का शोषण करती है, जो Top Store WordPress थीम = 1.5.4 में पाई गई एक गंभीर कमजोरी है। यह दोष प्रमाणित उपयोगकर्ताओं को, जिनके पास सब्सक्राइबर-स्तर या उच्च पहुंच है , असुरक्षित AJAX अनुरोधों के माध्यम से मनमाने प्लगइन इंस्टॉल और सक्रिय करने की अनुमति देता है। ⚠️...

cve-2019-14220

सारांश BlueStacks 4.120 और उससे नीचे के Mac तथा 4.110 और उससे नीचे के Winodws पर bstutils सेवा में एक असुरक्षित विधि एक स्थानीय हमलावर को सिस्टम विशेषाधिकारों के साथ मनमानी फ़ाइलों की सामग्री पढ़ने की अनुमति देती है। विवरण BlueStacks एक Android एमुलेटर है जो Windows और Mac सिस्टम के लिए उपलब्ध है...

CVE-2026-14960-CVE-2026-14961

Pegatron TdeIo64 ड्राइवर tdeio64.sys में विशेषाधिकार वृद्धि कमजोरियाँ | ---|--- CVE आईडी| CVE-2026-14960, CVE-2026-14961 विक्रेता| Pegatron Corporation उत्पाद| TdeIo ड्राइवर tdeio64.sys डिवाइस इंटरफेस| \.\TdeIo कमजोरी प्रकार| अनुचित पहुँच नियंत्रण CWE-284, मनमाना कर्नेल मेमोरी पढ़ना/लिखना...

EUVD-2026-68020

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...

EUVD-2026-68010

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In...

The vulnerability of the `merge_sched_in()` function in the kernel/events/core.c module, which manages kernel events in Linux operating systems, allows a hacker to cause a service failure.

The vulnerability of the mergeschedin function in the kernel/events/core.c module, which manages kernel events in Linux operating systems, is related to the use of an unprotected alternative channel. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-15001 bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

EUVD-2026-56031

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before...

CVE-2026-72561

CVE-2026-72561 describes a broken access control in Peppermint Lab Peppermint. Through commit ba6e217, any authenticated non-administrative user can reconfigure the platform’s global OIDC/SSO settings via an unprotected configuration endpoint that performs no administrative role check before appl...

CVE-2026-72561 Peppermint Lab Peppermint - Broken Access Control

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before...

ROS-20260810-73-0004

The vulnerability of the JAXP component in the Oracle Java SE software platform and the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to...

ROS-20260810-73-0005

The vulnerability of the JAXP component in the Oracle Java SE software platform and the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to...

ROS-20260810-73-0007

The vulnerability of the JAXP component in the Oracle Java SE software platform and the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to...

CVE-2026-44964

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-67621

Flowise 3.1.4 has a missing authorization flaw on document store mutation endpoints (upsert and refresh). This allows authenticated workspace members with only view-level permissions to perform unauthorized document ingestion, refresh the vector database contents, consume embedding API credits, a...

CVE-2026-70618

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/guildid/roles/roleid/member-ids endpoint without guild membership verification. Attackers can exploit the...